npm scope

@asyncapi

LPM Firewall blocks 4 packages in the @asyncapi npm scope. 1 has LPM's own review and is listed first.

Jul 14, 2026

@asyncapi/generator@3.3.1

The package contains an import-time, obfuscated detached child-process launcher in a validator module. This is concrete hidden execution, not a package-aligned generator feature.

Jul 14, 2026

@asyncapi/generator-components@0.3.3

Malware

OpenSSF Malicious Packages via OSV confirms @asyncapi/generator-components@0.3.3 as malicious (MAL-2025-190656): Malicious code in @asyncapi/generator-components (npm)

Jul 14, 2026

@asyncapi/generator-helpers@0.2.2

Malware

OpenSSF Malicious Packages via OSV confirms @asyncapi/generator-helpers@0.2.2 as malicious (MAL-2025-190657): Malicious code in @asyncapi/generator-helpers (npm)

Jul 14, 2026

@asyncapi/specs@6.11.2

Malware

OpenSSF Malicious Packages via OSV confirms @asyncapi/specs@6.11.2 as malicious (MAL-2025-190643): Malicious code in @asyncapi/specs (npm)